Advisory says that logging software may have stolen some users' passcodes.

Share this story

Twitch, the Amazon-owned game video streaming service, has reset passwords for all its users after warning of a security breach that may have allowed hackers to access user names, passwords, and other personal information.

According to a blog post Twitch published Monday evening, current passwords have been expired and users will be required to create a new one the next time they log in. Accounts have also been disconnected from Twitter and YouTube. As is standard practice, anyone who used the same password for multiple services should assume it's compromised and create a new and unique passcode for each property. Credit card data was not affected, the company said.

Monday's advisory provided few details. E-mails sent to users said hackers may have gained unauthorized access to Twitch usernames and associated e-mail addresses, encrypted passwords, the last IP address users logged in from, and—for users who provided such information—first and last names, phone numbers, addresses, and dates of birth. According to a report from Venturebeat, a separate e-mail sent only to select users provided an intriguing additional detail. "While we store passwords in a cryptographically protected form, we believe it's possible that your password could have been captured in clear text by malicious code when you logged into our site on March 3rd," it said.

The full text of the widely sent e-mail read:

We are writing to let you know that there may have been unauthorized access to some of your Twitch user account information, including possibly your Twitch username and associated email address, your password (which was cryptographically protected), the last IP address you logged in from, and any of the following if you provided it to us: first and last name, phone number, address, and date of birth.

For your protection, we have expired your password and stream keys. In addition, if you had connected your account to Twitter or YouTube, we have terminated this connection.
You will be prompted to create a new password the next time you attempt to log into your Twitch account. If applicable, you will also need to re-connect your account to Twitter and YouTube, and re-authenticate through Facebook, once you change your password. We also recommend that you change your password at any other website where you use the same or a similar password.

We apologize for this inconvenience.

The Twitch Team

Further Reading

Curiously, at the same time that Twitch officials reported the breach, they relaxed the password requirements imposed on users, allowing them to use just eight characters. As Ars has explained before, eight is the bare minimum number of characters required for a password to be remotely secure, and each additional character offers orders of magnitude more entropy. Even worse for Twitch users' security, according to a tweet from password researcher Bruce K. Marshall, Twitch allowed users to choose the same potentially compromised password that had just been expired. There's little doubt that many users will choose this more convenient option and in the process lose any benefit they may have gotten from the mandatory reset.